Verify PAI image
Three steps: hash the file, check the signature, trace the build. All client-side — nothing is uploaded.
1
File — SHA256 checksum
🔒Computed entirely in your browser. The file never leaves your device.
Computed
Expectede55b5b3c9190f1dd465bcf8e3bd73d718505a5e83583d0a9ca28be3528085f4a
2
Signature — GPG verification
GPG signing is in progress — signature files will be available with the first stable release.
3
Transparency — build provenance
🏷GitHub release — pai-amd64.iso v0.1.0⚙️CI/CD build workflow run
Why should I trust this?

PAI images are built by a public CI/CD pipeline on GitHub Actions. You can:

  • Inspect every line of the build scripts
  • Re-run the workflow yourself on your own GitHub account
  • Compare the SHA256 hash of your locally-built image to the released one
  • Verify the GPG signature against a key whose fingerprint is published in the repo

If the SHA256 in Step 1 matches and the GPG signature in Step 2 is valid, you have cryptographic proof the file you downloaded is identical to what the build pipeline produced — byte for byte.